Cookie & Storage Notice

Essential authentication cookies

vidik_access holds a Supabase access token with the expiry returned by the authentication service. vidik_refresh holds the refresh token with a browser maximum age of 30 days, renewed when a new session is issued. On hosted HTTPS they are Secure, HttpOnly and SameSite=Lax. They are used to authenticate requests, not for advertising.

vidik_verifier binds an email confirmation or recovery request to the initiating browser. Its maximum age is 24 hours for signup and one hour for recovery; this does not extend the provider's confirmation-link lifetime. vidik_recovery marks a recovery flow for one hour. Sign-out clears the application authentication cookies. A local fixture preview can use vidik_fixture for up to one day; that cookie is not a hosted customer login.

Browser drafts and request keys

Local storage keys beginning vidik360:draft: and vidik360:onboarding: preserve unsaved configuration and onboarding fields. They are scoped to the account and, for configuration, the project/version. They have no automatic time limit. Saved drafts may be removed by the relevant save flow; you can clear local drafts in Privacy controls or clear the site's browser data.

Session storage keys beginning vidik360:report-email: retain request identifiers to prevent duplicate report-send requests after a retry or reload. They contain identifiers, not API credentials, and normally last until the browser tab's session ends. A pending signup acknowledgement may be retained in session storage until confirmation or cancellation.

Clearing local data does not delete saved server data, cancel a queued job or revoke an already shared report. On a shared computer, sign out and clear local drafts when finished.

Tracking and external sites

No optional browser analytics, advertising cookies or session replay were found in the reviewed application. No tracking-consent banner has been added because the application does not install those optional trackers. If that changes, the notice and any necessary consent controls must change before tracking is activated.

Stripe-hosted checkout and other external destinations operate separately and may use their own cookies. Browser/provider network metadata is distinct from VIDIK360's local draft storage. The current coordinate plot makes no map-tile request.